Information on malware blocked inline by AMP is found in the Malware Analysis section of the Reports tab.

Information on files sandboxed by AMP during the after phase is found in the CWS Dashboard tab and AMP Blocks section. See Dashboard.

Click the Threats tab and CTA Dashboard.

1. Health status. Shows an overall summary of threats discovered in your network by their risk level. Unresolved users are grouped by risk category. Note that a high number of lower risk threats may lead to more serious threats over time.

2. Relative threat exposure. Threat exposure based on your number of incidents and their risk level, compared to other companies within your same sector, similarly sized companies, and all companies globally.

3. Specific behaviors. High-level breakdown of the detected threats and unresolved behaviors in your network.

4. Highest risk. Unresolved incidents that currently pose the highest risk to your network and require your immediate attention.

5. Top risk escalations. Unresolved incidents that have recently showed an increase in risk.

Click the Threats tab and Confirmed.

1. This section shows confirmed threats and breaches on your network (incidents with a 100% confidence level) and their associated information.

2. Incidents detected with correlated behavior are grouped into a threat campaign, and each threat campaign is then labeled with a unique hash-tag group name.

3. Threat campaigns are listed in the vertical panel at the right of the page. You can check the state boxes to filter what threat campaigns are shown in the panel.

4. A higher risk number indicates a higher risk of the threat impacting your network. Prioritize your analysis by investigating higher risk threats including the incidents clustered within them.

5. These incidents to not require much time for investigation; they require immediate action. Set up recovery processes to adjust your workflow for CTA findings.

6. Review the threat-specific description and the recommended action for a more targeted remediation.

Click the Threats tab and Detected.

1. This section shows an overview of detected incidents, including noncorrelated CTA incidents and AMP retrospective incidents. You can also view the correlated CTA incidents that were grouped into threats in the Confirmed section.

2. You can filter which incidents are shown by choosing AMP and/or CTA and adjusting the date selector, search field, preferences, and state.

3. Use the Email Notifications page to enter email addresses to be sent a summary of new and updated incidents every 24 hours.

To start investigating an incident, click that incident to review its details. Investigate incidents with higher risk and confidence first. An incident typically consists of multiple activities or types of suspicious behavior.

Identify the affected device or server.

The SHA-256 hash of any malicious files found is also listed here. Hover over the red skull-and-crossbones icon and click View full report to open the sandbox report in a new window. See Sandboxing.

Inspect the parallel coordinates graph which at-a-glance shows information about the activities in the incident. Hover over each coordinate node in the line graph to show its interconnected information.

1. Start with the highest severity and work your way down.

2. Note the information in the Time column. Verify how long the malware activity has been reported. One of the characteristics of advanced malware activity is that the communication is persistent for a long time. If the incident has been reported for several days or weeks, it increases the chance that it was produced by advanced malware.

3. Identify any recent ongoing activity. Focus on any activities that have occurred within the past 48 hours.

4. Look for activities that occur in parallel and may suggest a C&C communication channel in use.

5. Review the connected lines. Do the domains make sense together? Are they related? A domain with changing IP addresses is suspicious. Correlate it with the web flows table to determine if the domain was transferring data.

6. Are activities tied to the same AS or different systems from different owners and different locations? May be an indicator of systems that have been hacked and used as attack sources.

The graph can be used to filter web flows. Select and click one or more nodes to show the associated web flows.

1. Note the box next to the server. A red box indicates a negative IP reputation for that server. Domain names are included. The negative IP reputation could indicate suspicious communication from a domain operated by an attacker.

2. Note the HTTP status code returned from the server. A red box with an "x" next to the status code indicates that the flow was blocked by the web proxy. Focus on any incidents that have at least one command-and-control (C&C) channel which is not being blocked and thereby allowing the malware to operate.

3. If a sandbox report of the file is available, an icon appears next to the SHA-256. Hover over the icon and click View full report to open the sandbox report in a new window. A red skull-and-crossbones icon indicates that the file was found to be malicious. See Sandboxing.

Detected incidents have less than a 100% confidence level. Based on the details of the actual incident, the following factors may lower or raise the reported risk: